INSERT CO IN 



sialic MRCHINE_CONFIG_STRRT( tokio, bubl bobl_state ) 

/* basic machine hardware V 

HCF6_CPU_flDD( maincp. , Z80, MRIN_XTRL/ ) // 6 MHz 
HCFG_CPU_PROGRRM_MRP(tokio_iiap) 

MCFG_CPU_YBLRNK_INT_DRIVER( 5 : , bubl bobl_state , i rq0_l i ne_hol d) 

HCFG_CPU_RDD( slave' , Z8G, HRIN_XTRL/-) // 6 HHz 
HCFG_CPU_PROGRRn_HRP{ toki o_sl ave_map) 

HCFG_CPL_YBLRNK_INT_DRIVER( " screen' ' , bubl bobl_state, irq6 1 ine hold) 

MCFG_CPU_RDD("audi ocpu" , Z80, HRIN_XTRL/8) // 3 HHz 
HCFG_CPU_PROGRRH_HRP(tokio_sound_niap) 

HCFG_QLflhTUH_TIHE<attOtiie::froil_hz{6e00)) 

MCFG_HRCHINE_5TRRT_0VERRIDE( bubl bob l_State, toki o) 
MCFG_MRCHINE_RE5ET_0 YERRIDE( bubl bob l_st ate, toki o) 

/* video hardware */ 
HCFG_SCREEN_RDD( " screen" , RRSTER) 

MCFG_5CREEN_RRU_PRRRM5(MRIN_XTfll_/4, 384, 0, 256, 264, 16, 240) 
MCFG_SCREEN_UPDRTE_DRIVER( bubl bob l_state, screen_update_bubl bobl ) 

MCFG_GFXDECODE( bubl bob 1 ) 
HCFG_PRLETTE_LENGTH< ) 

/* sound hardware */ 
HCFG_5PERKER_5TRNDRRD_H0N0("niono") 

HCFG_50LND_RDD( t, y[!l5^d ,, , YH2203, HRIN_XTRL/8) 
HCFG_5OUND_CONFIG<yni2203_COnfig) 
MCFG_5OUND_ROUTE(0, "mono", 0.08) 
HCFG_50UND_R0UTE(1, "mono", 0.08) 
MCFG_50UND_R0UTE(2, "mono", 0.08) 
HCFG_S0UND_R0UTE(3, "mono", 1.0) 
HRCHINE CONFIG END 



OUR SCORE U@b 



TIME ©91 
TOP SPEED 835 
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Warm Sie glauben. 
class wit bei der 
Entwicklung von 
Berzerk a us dem 
Mauschen geralen 
sind, dann naben Sie 
recht! Wir haben hier 
erstmals unsere 
gesamte Technolog* 
und all unset Wisserv 
in ein einielnes Video- 
Spiel gesieckf. Das 
Ergebnis 1st ein Video- 
Meisterwerk, das mcht 
n ur die Spieler absolut 
auiser Rand and Sand 
geraten lasst, sOndern 
das auch die Gewinne 
direkt in denQperaloren 
treibt 

AUFZAHLUNG IN NOVA 
TfVEfl BESONDEH- 
H F I TFN VON BEHZEFlK 

■ Unijbartroflener YVorl- 
schafz vpn 30 Worlen 
Hut da* Spiel tuin 
Spicier Naehrichten- 
verkahr unterhatten, 

■ 64.000 bebiebig ange- 
ordnels Modellvorlagen 
orscheinen in Jabynn- 
thi&eher Gastaitung fur 
explosive, sich nicht 
wiederhoiendei Action 
auf cter Yideo-Platte, 

■ Ein vor kurznm entwor- 
fener Daumnnhflbel 
arm&glieht at dam 
Spieler, das FJild des 
Humanoiden in 8 vor - 
schiadane Richlungan 
zii bewegen- 

■ Nach Spislende 
arachainan die bis 
d*lo eniel1«n 10 
hochstSn Punkl- 
gewinne auf dam 
Btldschirm. 

■ Seltat bei ausge- 
whaltwtwn Garat 
speichert die Infor- 
metionsdatai die bis 
dalo erziatten 
5 hdchsten 
Punktgawinn* 

■ Batriebaart "Anzie 
hung' lockt Spieler 
mil der zeitlieh 

Brogrammiflrterf 
lurchsaga an: 
J 'Munzam In der 
Tatche entdeckfV 

■ lo g is chen Taf e I n 
sind in leicht zugan- 
glichem Ausziahfach 
im Vordergetiagse 
untflrgabrflchi. wtl 
mCjhefosa Wartung 
9<!wahrlaislal. 

■) Hocbentwsckettea 
autematiaches 
□ i 8 g n os e[>rogra m m. 



Stern Electronics, lrc/1725 Divers-ey Parkway 
Chicago, Illinois 606 14, USA {3121 935-4500 

Tsler 254fii7. Enlwurf und HorsSsHuflg: 
Uniwsal Rsiiaitr Laboratar 55 Inc., 
eme T«dileig>seKschafl ces H«uses Stem 




SPbELEIGENSCHAFTEN 




Robotcr uerlolgen 
Humanoiden (Spider) 
durch sine der 64 QQQ 
mogiieben 
Modellvorlagen 




Humanaide vermeidel 
Roboter durch gakonnta 
Beta I ig u ng d££ Da u men- 
hebels. und ar vernichtel 
sie durch Feuerung 
seiner Gesctiosse 




Der "hose Otto" eine 
uruerstorbare Macht, 
erscheint aula Gerale- 
wohl am Blldschirm. urn 
den Hirmanoaden zu 
verfolgen und t%> vtr- 
nichten Er muss um 
jeden Pfeis vermieden 
werdenF 
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H Y F E R 
STREET FIGHTER 2 
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7*110 
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PROCESSOR 
STATUS 



MC6300 
PERIPHERAL 
CONTROL 



SYSTEM 
CONTROL 



V CC (2) 



GND(2) 



CLK 



FCO 



FC1 



f02 



^ VMA 



VPA 



BERR 



_ RESET 



HALT 



<1 



ADDRESS 



BUS 



> 



DATA BUS^ 
AS 



RW 



UDS 



LDS 



D'ACK 



BR 



BG 



BGACK 



IPLO 



IPL1 



[p. 2 



A23-A1 
D15^D0 



ASYNCHRONOUS 
BUS 

CONTROL 



BUS 

ARBITRATION 
CONTROL 



INTERRUPT 

CONTROL 



Table 3-3. Function Code Outputs 



Function Code Output 


Address Space Type 


pC2l 


FC1 


FCO 


Low 


Low 


Low 


(Undefined, Reserved) 


Low 


Low 


High 


User Data 


Low 


High 


Low 


User Program 


Low 


High 


High 


(Undefined, Reserved) 


High 


Low 


Low 


(Undefined, Reserved) 


High 


Low 


High 


Supervisor Data 


High 


High 


Low 


Supervisor Program 


High 


High 


High 


CPU Space 



Table 6-2. Exception Vector Assignment 


Vectors Numbers 


Address 


Space 6 


Assignment 


Hex 


Decimal 


Dec 


Hex 


0 


0 


0 


000 


SP 


Reset: Initial SSP 2 


1 


1 


4 


004 


SP 


Reset: Initial PC 2 


2 


2 


8 


008 


SD 


Bus Error 




U 11 I^C 1 II 


Jl 1 li^l 3, 


OOC 


SD 


Address Error 



2. Reset vector (0) requir es four words, unlike the other vectors which only 
require two words, and |s located in the supervisor program space? 

*3 Tha crti iri/ii ic intern int \i£ir*ir\r t c l/on uihan rs m in n Ki ic armr 
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MAX 330 MEGA 

PRO-GEAR SPEC 
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STREET FIGHTER ZERO 



Q 5 □ ft □ 5 



J A P A N 



WORK 
CFSO 
CPE 1 
CFS2 



RAM OK 
RAM OK 
RAM OK 



P UAL [§] AU Q|() 

©Sound Chips have been developed by ©Sound 



f^^f^f Ol^ aFl ^ ■ rcot "P ct " a " te ©Sound's proprietary ©Sound 
sound enhancement technology. 



OBJECT RAM OK 
O SOUND RAM OK 



CAPCOM 



NRFRT COIN 



©CAPCOM Co., Ltd. 1 QQF* 




r&sEtrj cons 




STREET FIGHTER ZERO 

Q 5 1 □ 2 □ 

CFS CHANGER 

MORK RAM OK 

CPEO RAM OK 

CPE 1 RAM OK 

CPE2 RAM OK 




ILLEGAL INSTRUCTION 

ADDRESS : 7A0A0000 
AC ADRS : 
R N : 
MODE i 
FC i 



DO :FFFF4A44 D4:00A80158 A0:6FC42E65 A4:00FFB380 
D 1 : □□□□□□□4 D5 : OOOOFFFF A 1 : 00FF08 1 C A5 : □□□□□□□□ 
D2:00080000 D6 : GOOOOOOO A2:007082F0 A6 : FFFFAD80 
D3: 00000008 D7 : 00000000 A3:00FFB19A A7:0000000A 

SSP : 00FF08 1 C 
SRMA44 

+0 +2 +4 +6 +8 +A +C +E 
00FF8000 0010 0000 0002 0000 0002 0071 0000 0000 
00FF8010 0000 0000 0000 0000 5680 0000 0000 9000 
00FF8020 92C0 90C0 9100 9160 9140 0000 0000 01 DA 
00FF8030 OOOC 01B5 0006 OOOC OOOF 12C2 0000 0000 
00FF8040 0000 0000 003F 7000 807D 1234 0040 0010 
00FF8050 0000 0000 0000 0000 0000 0000 0000 0000 
00FF8060 E021 OFOC 0000 0000 0100 FFFF FFFF FFFF 
00FF8070 FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 



Mode 


Generation 


Syntax 


Register Direct Addressing 

Rata Ranictar nir^^l 
uala ntfyislcr uncial 

Address Register Direct 


Qr\ — l/i l 

EA=An 


An 


Absolute Data Addressing 

Absolute Short 

t 1. h_l i_l I - 1—1 L '—r h_H 1 1 h_T 1 L 

Absolute Long 


EA = (Next Word} 

l_ P b 1 1 ^1 l_r JTH L 9 T h— T I 4J J 

EA = (Next Two Words) 


1 J *l f \ PL p 1 ■ ■ 

(xxx).L 


Program Counter Relative 
Addressing 

Rplatiup. with ("Iff ^pt 

Relative with Index and Offset 


FA-(PCUdi{3 

tn- tr^J+UQ 


<d 16 ,PC) 

Mo Pr Xrrt 


Register Indirect Addressing 

Register Indirect 
Postincrement Register indirect 
Predecrement Register Indirect 

Indexed Register Indirect with Offset 


EA = (An) 

EA = (An), An «- An+N 
An + An-N, EA=(An) 

FA — / An 't iH h c 
Cn — \ r\ I I J-r\A \ 

EA = (An)+(Xn)+d 8 


(An) 
(An)+ 

-(An) 

/H-ie Aril 
l a 1 Gin"! 

(da,An,Xn) 


Immediate Data Addressing 

ii i ii i lyijicUV 

Quick Immediate 


DATA - Npvt WnrdKl 

U f \ 1 n ™ 1 H G A L V V Ul U L J 

Inherent Data 




Implied Addressing 1 

Inrmliprl Rpni < stp'[ r 


EA - SR USP RSP PC 
VBR, SFC, DFC 


SR URP RRP PC 
VBR, SFC S DFC 



This mode is similar to the mode described in 2.2.7 Address Register Indirect with Index 
{8-Bit Displacement) Mode, except the PC is the base register. The operand is in memory. 
The operand's address is the sum of the address in the PC, the sign-extended displacement 
integer in the extension word s lower eight bits, and the sized, scaled, a nd sign-extende d 
index operand. The v alu e in the PC is the address of the extension word. [This is a program 
reference allowed only for reads| . The user must include the displacement, the PC, and the 
index register when specifying this addressing mode. 




Swof: 00 1:21 

Credi ts : 88 



reset 
nop 
nop 
nop 

move.b ft$80, $800030.1 

nop 

nop 

nop 

nop 

nop 

nop 

nop 

move.b ft$0, $800030.1 
cmpi.l ff$5642194. D0 
lea ($6, PC), fl4 
bra $d82 



lea 


(J6-PC). R2 


bra 


$ef6 


jmp 


(M) 


moveq 


ff$lf, D7 


move. 1 


a$f000f000, D0 


cmpi . 1 


*$5642194. D0 


move. 1 


(fl0)+, (Rl) 


or. 1 


D0- (Rl)+ 


move. 1 


(R0)+, (Rl) 


or. 1 


D0. (Rl)+ 


move. 1 


(R0)+ s (Rl) 


or. 1 


D0- (Rl)+ 


move. 1 


(A0) + , (HI) 


or. 1 


D0- (fll)+ 


move. 1 


(A0) + , (AO 


or. 1 


D0- (fll)+ 



lea 


($6, PC), fl2 


bra 


$d96 


jmp 


(A4) 


moveq 


*$lf. D7 


move. 1 


ft$f000f000. D0 


move. 1 


(fl0)+, (fll) 


or. 1 


D0. (fll)+ 


move. 1 


(fl0)+, (fll) 


or. 1 


D0. (fll)+ 


move. 1 


(fl0)+, (fll) 


or. 1 


D0- (fll)+ 


move. 1 


(fl0)+, (fll) 


or. 1 


D0- (fll)+ 


move. 1 


(fl0)+, (fll) 


or. 1 


D0. (fll)+ 


move. 1 


(fl0)+, (fll) 



Game CPU Settings Video Sound Net Help 



STREET FIGHTER ZERO 



9 5 □ 7 2 7 



JAPAN 



| System reset 



CSO 



Game CPU Settings Video Sound Net Help 



INSERT 2 COINS 
CONTINUE REGUIRES ONLY 1 COIN 



©CAFCOM Co. j Ltd. 1QQ5 




System reset 



CSO 



Game CPU Settings Video Sound Net Help 




OS OLind Chips ha^e been developed by OS ound 
and incorporate OS ound ' s proprietary OSound 
sound enhancement technology. 



CAPCOW 




flashdol 



stories 
submissions 
popular 
blog 

ask slashdot 

book reviews 

games 

idle 

yro 




CPS-2 Encryption Scheme Broken 



Posted by Hemos on Sunday January 07, 2001 @1 0:44AM 
from the more-roms-for-all dept. 



Acheon writes: 

"The CPS-2 arcade board from Capcotn uses some hard encryption 
scheme that has been a very hot issue in emulation for years. Yet 
finally the code was broken Final Burn , a quite recent arcade emulator, 1 
showed concrete results by running previously unsupported games 
such as Street Fighter Zero using decrypted ROM images. The CPS-2 1 
Shock Team, who managed to reverse engineer the process for 
scratch, really outdone themselves and it is a very uncommon 
achievement." 



CPS2 arcade encryption smashed 

Morality debate ensues 

By Lucy Sherriff - Get more from this author 

Posted in Business, 8th January 2001 19:44 GMT 

A group of gaming enthusiasts called the CPS-2 Shock Team claims to have broken the encryption on 
the CPS-2 arcade board from Capcom. 

While the algorithm itself has not been compromised, the group has managed to extract unencrypted 
data from the board using the 68k code on the hardware itself, according to a poster on SlashDot. 
Whether this actually constitutes a break of encryption is a subject under discussion at the 
aforementioned geek site. 
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Use the JoystioK to 
^HoNinO buttons 4 



BU t Ion I 

Ru t I nn S 

□U t ton 3 

UU t ton 4 



Spc-oJ so 
. Jliji-b 1 a 
ToSOle s 
U Li i t ■ 



or oil -and th 
•Hiv mm* 

roll- 

hmk re 3 I on. 
elected btr^ 



OFFSET 40 43 



BANK 



i 

dill 

Si 
I 1 

■ ■ 



ChDGOGO 
□ □onos 
OOOO 10 
D-DCU i a 



OO 10 
Q0C0 

DUUD 



mm esse 

8B8S3B 8888 



no HOT niSTRTRUTF THIS SOF IHflHF ■ 



as 

I 1 



□□on 4Q ouco 

000040 O0O0 
DOODAD OL1UD 

8S88i§ 8888 
8388 8888 

□ □on 7 Fi onnn 



F3O0 

0414 

□4 2C 

8111 
83i£ 

O420 
□4 2E 



oooo 

oacn 
OOOO 
□■□UU 



oaon 
OOOO 
□oca 



040S 

n4QF 
04SG 

□ Q- 

8 tie 

o-iac 

042G 

□ lae 



831! 8888 MSB 



D4 3E 



oaon 



2S3G 

83 SS 

□ 4ae 
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6 E O HACKER by R-iZuo I i 



H E 



SUr t PO 3o4tb4rc rik< 
cnnnn c t t> H. ■: but Inn. ] tn 



sure toad 
cnnl I nijp] 



Use PC tool to ores, to needed -fides 
for v nr - J + I kill tcin ] tn cant In lip? 



Use jdVeI ich 1o ekoose a. re9 i an to 

dump, c button 1 to conl tnue) 



Use joVeI i ak Ho ekoose a. re 9- ion to 

verlfv- 'button 1 to continue? 



> ROM DAfHK 1 < 



> ROM fWEA < 



MDH DUJIPTHG P3 FflSF UfllT. 
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VERIFY IMG ADDRESS **OQQ032rS 
H-TCICUS : tiDOU 



DD HD T O IS TEf T RU TF THIS SOFTUflEF 



move . w 
move . w 
move . w 
move . w 
move . w 
move . w 
move . w 
move . w 
cmp i . 1 
lea 
bra 

move . w 
move . w 
move . w 
move . w 
move . w 



#$7000, $400000.1 
#$0, $8040a0.1 
#$807d, $400002 
#$1234, $400004 
#$0, $400006.1 
#$40, $400008.1 
#$10, $40000a.l 
#$f00, $804040.1 
#$5642194, DO 
($6, PC) , A4; ($9d6) 
$e82 

#$ffc0, $80010c.l 
#$0, $80010e.l 
#$9000, $800100.1 
#$9080, $800102.1 
#$90c0, $800104.1 



move . w 
move . w 
move . w 
move . w 
move . w 
move . w 
move . w 
move . w 
cmp i . 1 
lea 
bra 

move . w 
move . w 
move . w 
move . w 
move . w 



1 



#$7000, $fffff0 
#$ 0, $80 40a0.1 
#$807d, $fffff2 
#$1234, $fffff4 
#$0, $fffff6.1 
#$40, $fffff8.1 
#$10, $fffffa.l 
#$f00, $804040.1 
#$5642194, DO 
($6, PC) , A4; ($9d6) 
$e82 

#$ffc0, $80010c.l 
#$0, $80010e.l 
#$9000, $800100.1 
#$9080, $800102.1 
#$90c0, $800104.1 



SUICIDE CPS2 GAME 


BOARD TESTER 


ON BOARD RAM TE 


EST 


WORK RAM 
GFX RAM 
OBJECT RAM 


= GOOD 
= GOOD 
= BAD 


SOUND 1 N 1 T 
G SOUND RAM 


= GOOD 
= GOOD 


ERRORS FOUND ON 


GAME BOARD 


( C ) RAZOOLA j NNH . CFS2SHOCK . COM 




PHOENIX EDITION 

> REGION SETUP < 
JUKEBOX PL AVER 



START GAME 



■ink' 




CAPCOM CPSU 18 III 1 




CONT I NCJE 9 




ROCKMAN THE POWER BATTLE 



q 5 □ q a a 

J ft P ^ N 



HORK 
CFSO 
CPE 1 
CFS2 



RAM OK 

RAM OK 

RAM OK 

RAM OK 




HORK 
CPEO 
CPE 1 
CFS2 
OBJECT 



RAM OK 

RAM OK 

RAM OK 

RAM OK 

RAM OK 



O SOUND RAM OK 



E O U N D 



V O I 



T E E T 



3 . SOUND 



V O I C 



EST 



SOUND CODE No. QQQQ 



SOUND CODE Nc. QQQQ 



CODE +CM 
CODE -CM 
CODE +10 
CODE -Id 
REOUEET 
STOP 



UP 

DOWN 
R I GHT 
LEFT 
EHOT1 
EHOT2 



CODE +CM 
CODE -CM 
CODE +10 
CODE -Id 
REOUEET 
ETOP 



IP UP 

IP DOWN 

IP RIGHT 

IP LEFT 

IP SHOT1 

IP SHOT2 



VOLUME 

-++??++- 



MAX 



EXIT = IP & 2F START 



EXIT = IP & 2F START 



IAMRM \ NG UP NOW 




PPESENTEO KOKWH I 



Links 



• CPS2Shock 

http://www.cps2shock.com 

http://web.archive.ora/web/*/http://cps2shock.retroqames.com 

• Charles MacDonald's Home Page 

http://cqfm2.emuviews.com/old2005.php 

• Nicola's MAME Ramblings 

http://mamelife.bloqspot.com/2006/01/8qb-2-is-still-4qb.html 

• Notas de Andy 

http://andreasnaive.bloqspot.com/2006 12 01 archive.html 



• CPS2 encryption 

http://mamedev.org/source/src/mame/machine/cps2crpt.chtml 
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PI: LK MP U (S+LP) 
P2 : HK MP 

TRAD I T I ONAI 



MENU 




LP LP R LK HP (S+LP) 



CHALLENGER 



GAME 



DATA 



CO IN 



COUNTER 000036 



SERVICE COUNTER OOOOOO 
FREEPLAY COUNTER OOOOOO 



T E S 



1 INPL 

2 OUTF 

3 sour 
a colc 

5 DOT 

G GAME 

7 CONF 

8 MEMC 




PI: L R D U (S+LP) 

P2 : R D HK LP 

ENJOY NEW FIGHTING STYLI 




USB-B 



O 



Sega-USB Link ul. 1 

<C) 2004-2011 Charles MacDonald 

https / /eg fm2- emu<j ieus- com 
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UNIVERSE BIDS 3- D bY RBZDOLA 

PC-2-NE0 DATA TRANSFER 

AN[] PH SOF fllflRF IS PUNNING 

— uuhhlh i ainiuy. — 

flAfllllNB INSTRUCTION 

BUT TOM OONTROI 

PRESS (0 10 STOP AND EXIT 



OTO HUN- UN I VhHShH t(]H- CDM T □ 
TNH LATEST NEHS BHD UPDATES 



NEOGEO 

LJH T VFHfiF BTOR, 3, O hv RAJTIOJ ft 



► REGION SETUP (ftSKZ) 

[ ] GENERAL BIOS SETTINGS 

[ ] CAMECART ORG CHECK 

[ ] JUKEBOX PLAYER 

[ ] PC-2-NE0 .nv-ik: 

" " AW tton C to ExM 

r;n rn uuu iin iuuuucu rnt^. tmn Tin 




NEOGEO NEOGEO 

UNIVERSE BIOS 3.Q bv RfiZQOLA I ^^^J^^^T ^L. I -Jr 
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□END SOUND Ml TM 
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WIrJ U ■ UN I VERSEB I OH ■ C !OM T □ 
LBTEST NEHS BNEJ UPDATES 



— UHIUERSE BIOS u3,D — 

Res ion EUROPE Vode-fiRCflDE 



NK 




i THE CHE 

DEBUG D 
PATO 

SOFT RE 




ABASE ► 

TINGS 
RT 

VST Ell 




DEBUG 



DIP SETTINGS M 
ON GfiHE RESET 

-DIP I- -Dl 

ODQQoaoo oaoo 

IZ31K671 1^31 
BUTTON D 

(fl)=SET CB)=RE 




NEOGEO 

LJN T VFHSF BIAS 3-0 bV ROJ'OOI ft 



GAMECART CHECK ID =0232 

GETTING OH DATA HELD 

IN THE GnRTS PHQGhAH ROMS- 

ink U : 



?Of1 Hrink I 
toff Dink 2 
EDM Bank J 



CALCULATING.. (C) TO 



C-iO r □ HU U ■ UN I Vh HHE- B [ OH- C !ON T □ 
r TNQ LBTEST NEHS BHD UPDATES 



WARE SELFTEST FAILED 



OR 



WORK RAM REGION 

BOR3- MR RE 

ODlOaifl? B5B5 BBDS 



WARE SELFTEST FAILED 



UNIVFHKF BIOS .lr O hv RA^OOI ft 



JUKEBOX MUSIC PLAYER 

Wo%m l&kH'UiriPiXKB 

SELECT B DBHE CODE 

CURRENT CODE* 0x0721 

BUTTON OONTROl 

!A)=PLAY (BJ=ST0P <C>=F.XIT 



KOUD UUU- UN I VF-HHE-B [OH- COM TO 
F TND LBTEST NEHS BHD UPDATES 



INPUT TEST 




